From dc1793fae7d8b67b9418e01e560fde5073bfa88b Mon Sep 17 00:00:00 2001
From: masumi ryugo <280057467+masumi-ryugo@users.noreply.github.com>
Date: Sun, 3 May 2026 17:31:07 +0900
Subject: [PATCH 1/2] fix(parquet): reject negative num_children before
 Vec::with_capacity

`schema_from_array_helper` cast `SchemaElement::num_children` from
`i32` to `usize` via `n as usize`. A negative count wraps to a huge
`usize`, which `Vec::with_capacity` then turns into a capacity-overflow
panic.

Replace the cast with `usize::try_from(n)?`, surfacing it via the
existing `From<TryFromIntError> for ParquetError` impl.
---
 parquet/src/schema/types.rs | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/parquet/src/schema/types.rs b/parquet/src/schema/types.rs
index 2c63da74df47..c1df296235ea 100644
--- a/parquet/src/schema/types.rs
+++ b/parquet/src/schema/types.rs
@@ -1401,7 +1401,7 @@ fn schema_from_array_helper<'a>(
         Some(n) => {
             let repetition = element.repetition_type;
 
-            let mut fields = Vec::with_capacity(n as usize);
+            let mut fields = Vec::with_capacity(usize::try_from(n)?);
             let mut next_index = index + 1;
             for _ in 0..n {
                 let child_result = schema_from_array_helper(elements, num_elements, next_index)?;
@@ -2517,4 +2517,22 @@ mod tests {
         let result_schema = parquet_schema_from_array(thrift_schema).unwrap();
         assert_eq!(result_schema, expected_schema);
     }
+
+    #[test]
+    fn test_parquet_schema_from_array_rejects_negative_num_children() {
+        let elements = vec![SchemaElement {
+            r#type: None,
+            type_length: None,
+            repetition_type: Some(Repetition::REQUIRED),
+            name: "schema",
+            num_children: Some(-1),
+            converted_type: None,
+            scale: None,
+            precision: None,
+            field_id: None,
+            logical_type: None,
+        }];
+        let result = parquet_schema_from_array(elements);
+        assert!(result.is_err(), "expected error, got {result:?}");
+    }
 }

From 137bba520e420c71963c999c6208b3438b873a8c Mon Sep 17 00:00:00 2001
From: masumi ryugo <280057467+masumi-ryugo@users.noreply.github.com>
Date: Wed, 6 May 2026 16:30:19 +0900
Subject: [PATCH 2/2] test(parquet): assert specific Integer overflow error in
 negative num_children test

Addresses review nit from etseidl (concurred by alamb): asserting
the specific error string ensures the test continues to cover the
intended failure mode if the underlying error mapping ever changes.
---
 parquet/src/schema/types.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/parquet/src/schema/types.rs b/parquet/src/schema/types.rs
index c1df296235ea..0d504e16fc28 100644
--- a/parquet/src/schema/types.rs
+++ b/parquet/src/schema/types.rs
@@ -2533,6 +2533,6 @@ mod tests {
             logical_type: None,
         }];
         let result = parquet_schema_from_array(elements);
-        assert!(result.is_err(), "expected error, got {result:?}");
+        assert!(result.unwrap_err().to_string().contains("Integer overflow"));
     }
 }